MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 de976a48fc0a6d712682c3f1d3740d185182a80e514b272afe7cd733ad6208ca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	de976a48fc0a6d712682c3f1d3740d185182a80e514b272afe7cd733ad6208ca
SHA3-384 hash:	0c232dac0d060cfad50d2bff2027160277fb8b2b6b701afb0ee3626749e170f39858cef2e85cfa1fd165e38fa2a51e5c
SHA1 hash:	31fade7434cc41b87a7d00040ed61800a567d99c
MD5 hash:	0cfe38cdad93599d146837e75c345703
humanhash:	maine-ceiling-illinois-johnny
File name:	silent.vbs
Download:	download sample
Signature	QuasarRAT Alert Create hunting rule
File size:	379 bytes
First seen:	2026-10-21 18:41:13 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	6:j+q9NqcN7fBMbHTnc0JHsLlnc4KFrFHJh5kHibrFHJhrz+OLXHsL0yJHnHsLbn:KqacN140L1AFHJh5pFHJhnL8LtiLb
TLSH	T1ABE092EF15064CB3F54A95C8F6B6A949479D7D4464D77D76C6C4CC110108C70A223BC8
Magika	batch
Reporter	BlinkzSec
Tags:	QuasarRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

75

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/93700/

CyberFortress Malicious

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad9074f5a22ac805bd91de5

Tags:

agent overt sage

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

conhost cscript evasive lolbin obfuscated opendir

Link:

https://www.filescan.io/uploads/6ad96586861203bc23e90866/reports/fc62d16b-ae6c-4250-8ded-6f65cab80bb3/overview

Hybrid Analysis Unknown

Verdict:

Suspicious

Link:

https://www.hybrid-analysis.com/sample/de976a48fc0a6d712682c3f1d3740d185182a80e514b272afe7cd733ad6208ca

Nucleon Malprob Susipicious

Score:

55%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/de976a48fc0a6d712682c3f1d3740d185182a80e514b272afe7cd733ad6208ca

Malva.RE Malware

Verdict:

Malware

YARA:

1 match(es)

Tags:

Batch Command COM Behavior Trace DeObfuscated Obfuscated PowerShell PowerShell Call T1027 T1059 T1059.001 T1059.005 T1105 VBScript WScript.Shell

Link:

https://app.malva.re/file/0cfe38cdad93599d146837e75c345703

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/de976a48fc0a6d712682c3f1d3740d185182a80e514b272afe7cd733ad6208ca/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=32lwush4bjwxcjucypy5g5andbiyfkaokffsokx6ptlthllcbdfa._file

Hatching Triage quasar

Result

Malware family:

quasar

Alert

Create hunting rule

Score:

  10/10

Tags:

family:quasar defense_evasion execution persistence spyware trojan

Link:

https://tria.ge/reports/261021-xfbfvsxs5k/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

cURL User-Agent

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Executes a command shell one-liner

Executes a VBScript file via the Windows Script Host.

Indicator Removal: File Deletion

Checks computer location settings

Badlisted process makes network request

Family: Quasar RAT

Quasar payload

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.20

Link:

https://yomi.yoroi.company/submissions/de976a48fc0a6d712682c3f1d3740d185182a80e514b272afe7cd733ad6208ca

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/93700/